CVE-2020-8553: ingress-nginx auth-type basic annotation vulnerability

[aledbf]

A security issue was discovered in ingress-nginx versions older than v0.28.0. The issue is of medium severity, and upgrading is encouraged to fix the vulnerability.

Am I vulnerable?

The vulnerability exists only if the annotation nginx.ingress.kubernetes.io/auth-type: basic is used.

How do I upgrade?

Follow installation instructions here

Vulnerability Details

A vulnerability has been discovered where a malicious user could create a new Ingress definition resulting in the replacement of the password file. The vulnerability requires that the victim namespace and/or secret use a hyphen in the name.

This scenario requires privileges in the cluster to create and read ingresses and also create secrets.

This issue is filed as CVE-2020-8553.

/close

[k8s-ci-robot]

@aledbf: Closing this issue.

Details

In response to this:

A security issue was discovered in ingress-nginx versions older than v0.28.0. The issue is of medium severity, and upgrading is encouraged to fix the vulnerability.

Am I vulnerable?

The vulnerability exists only if the annotation nginx.ingress.kubernetes.io/auth-type: basic is used.

How do I upgrade?

Follow installation instructions here

Vulnerability Details

A vulnerability has been discovered where a malicious user could create a new Ingress definition resulting in the replacement of the password file. The vulnerability requires that the victim namespace and/or secret use a hyphen in the name.

This scenario requires privileges in the cluster to create and read ingresses and also create secrets.

This issue is filed as CVE-2020-8553.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tamir-ben]

Any relevant commit for the issue? I couldn't find one regarding the issue number #126818

[atoptsoglou]

Any relevant commit for the issue? I couldn't find one regarding the issue number #126818

I had the same question. I went through the changelog and I saw no reference of the CVE instead I saw another CVE and a sentence which looks like with this issue. My guess was that there is a typo. Did a pull request kubernetes/ingress-nginx@ed81ee3 to see if this is indeed the case. If it is, then the relevant commit should be https://github.com/kubernetes/ingress-nginx/pull/4960/commits
However, I would prefer that someone confirm my comments.

[aledbf]

@atoptsoglou that's correct. The description in the CVE is missing the part of privileges related to secrets.

[cji]

/transfer kubernetes

[cji]

/area security
/kind bug
/committee security-response
/triage accepted
/lifecycle frozen
/label official-cve-feed